[gentoo-user] certbot confusion

[Ian Zimmerman]

I don't understand the letsencrypt certbot renewal process, specifically
the hooks.

I have two certificates: one for webserver, one for mailserver.  I got
them only very recently so I until now the renewal cronjob has always
been a no-op, but the real thing will happen very soon.  When it does,
presumably I need to have both daemons restarted so that they read the
renewed certificates.  So, how do I do this?  Right now my cronjob is
just

certbot renew -n --standalone --preferred-challenges tls-sni

which should renew any and all certificates when they're "close" to
expiring.  But the documentation doesn't say if I can have multiple
--pre-hook and --post-hook options and what the semantics would be.  The
closest it comes is:

 When renewing several certificates that have identical pre-hooks, only
 the first will be executed.

which doesn't make any sense: what does it mean for a certificate to
"have" a pre-hook?  The pre-hook is just there on the command line,
there is no association with a particular certificate that a machine
could infer.

The cop-out solution is to have a single pre-hook and a single
post-hook, which stop (resp. start) both daemons, but that is ugly.  How
do people handle this?

-- 
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
Do obvious transformation on domain to reply privately _only_ on Usenet.